Ureader.com  
Microsoft software help and Community
   home   |   control panel login   |   archive   |  
 
DotNet
acad.assignment.mngr
academic
adonet
aspnet
aspnet.announcements
aspnet.build.controls
aspnet.caching
aspnet.datagridcontrol
aspnet.mobile
aspnet.security
aspnet.webcontrols
aspnet.webservices
clr
compactframework
component_services
datatools
distributed_apps
drawing
faqs
framework
framework.wmi
general
internationalization
interop
languages.csharp
languages.jscript
languages.vb
languages.vb.controls
languages.vb.data
languages.vb.upgrade
languages.vc
languages.vc.libraries
myservices
odbcnet
performance
remoting
scripting
sdk
security
setup
vjsharp
vsa
webservi.enhancements
webservices
windowsforms
windowsforms.controls
winforms.databinding
winforms.designtime
xml
  
 
date: Mon, 14 Apr 2008 14:14:58 -0400,    group: microsoft.public.dotnet.security        back       


Problem with validating XML Digital Signatures - missing HMACSHA1 algorithm in .Net API   
I am trying to validate a signature within an XML Document that uses the 
HMAC signature algorithm (WSE3.0 chose this algorithm, I'm just trying to 
validate the signature).

I keep getting an error saying that it can't get a SignatureDescription 
object, so I did some dissasembling and research and I have found that there 
is no mapping for the standard http://www.w3.org/2000/09/xmldsig#hmac-sha1 
signature method in the CryptoConfig object (which is used to create the 
appropriate class to validate the dignature signature when calling the 
CheckSignature method of the SignedXml object).


Here is my question:  Why isn't this standard algorithm implemented in the 
the CryptoConfig (I've found dsa-sha1 but not hmac-sha1)?

For example; this should work, but instead, returns null:
//returns null

object o = 
CryptoConfig.CreateFromName("http://www.w3.org/2000/09/xmldsig#hmac-sha1");

This however, returns the object as expected:

//Returns appropriate object

object o2 = 
CryptoConfig.CreateFromName("http://www.w3.org/2000/09/xmldsig#dsa-sha1");


As a secondary, and probably more important question, is there something 
manual I need to override in the CheckSignature method (or something else) 
to be able to supply the HMACSHA1 object to the classes that are doing the 
validation?


And finally (sorry to pack this one full), the key that did the signing has 
a SignatureAlgorithm itself of http://www.w3.org/2000/09/xmldsig#rsa-sha1 so 
nothing really seems to be lining up here - and I'm just a bit confused..... 
=\

Thanks!

Jediah L.
date: Mon, 14 Apr 2008 14:14:58 -0400   author:   Jediah L am

Google
 
Web ureader.com


    COPYRIGHT 2007, YARDI TECHNOLOGY LIMITED, ALL RIGHT RESERVE  |   contact us